I've found it's pretty easy to make many unique passwords with a length of 30+ characters, always with lots of symbols mixed in of course, of course. You just need to find a system that works for you and, practice, practice, practice.
I agree, working out a password system is the way forward. I have them written down in 'reminder code'. i.e. words which remind me of the password. For example if my password was: "brown1977Taylor1998cunt1kAfrica", my reminder code would be:
Login: MisterP
Password: firstcarYEARMaidenGRADrudeZX81Honey
When reading the reminder, I would know the following:
'first car' always refers to the colour = brown
'YEAR' is always the year after I was born = 1977
maiden is mums maiden name = Taylor
GRAD is always the year before I graduated from Uni = 1998
rude always = cunt
ZX81 was my first ever computer and always = 1k (that's how much memory it had!)
Honey is where my honeymoon was, so always = Africa
So these reminders / triggers would be enough to jog my memory on the order of the password components.... but only I would know what they mean.
After enough logins I tend to memorize the important p-words anyway, but the reminders are just there in case of amnesia.....
Find a system that works for you, and one that is interchangeble so you can change it up from time to time....
The problem with this system is that it depends on information that you know, or that is discoverable about you. If you should ever be raided, you can be certain that dictionary attacks will be mounted against your encrypted data based on your personal information. As evidence of this, I would refer you to Brian Krebs' excellent article in the Washington Post:
DNA Key to Decoding Human Factor
Secret Service's Distributed Computing Project Aimed at Decoding Encrypted Evidence
By Brian Krebs
washingtonpost.com Staff Writer
Monday, March 28, 2005; 6:48 AM
http://www.washingtonpost.com/wp-dyn/articles/A6098-2005Mar28.html (clearnet)
The way to defeat any such system is to choose passphrases that are random. I recommend Diceware: http://www.diceware.com/ (clearnet)
DIceware passphrases are chosen by means of a random physical process: dice rolls. Words are chosen from the Diceware list, based on the results of a 5-dice roll.
What Is Diceware?
Diceware™ is a method for picking passphrases that uses dice to select words at random from a special list called the Diceware Word List. Each word in the list is preceded by a five digit number. All the digits are between one and six, allowing you to use the outcomes of five dice rolls to select one unique word from the list.
Here is a short excerpt from the Diceware word list:
16655 clause
16656 claw
16661 clay
16662 clean
16663 clear
16664 cleat
16665 cleft
16666 clerk
21111 cliche
21112 click
21113 cliff
21114 climb
21115 clime
21116 cling
21121 clink
21122 clint
21123 clio
21124 clip
21125 clive
21126 cloak
21131 clock
The complete list contains 7776 short English words, abbreviations and easy-to-remember character strings.
Because the words are chosen based on random dice rolls, it is impossible for an opponent to know which words have been chosen, and in what order. Therefore, even if an opponent knew for certain that you had used Diceware, and that the length of your passphrase was 10 words, they would still be required to brute-force your passphrase. A 10-word Diceware passphrase contains 129-bits of entropy, or about twice the entropy of the 128-bit ciphers used in PGP/GPG, i.e. AES128, IDEA and CAST5. (FWIW, CAST5 is used by PGP/GPG to protect your private key.)
Your passphrase is your absolute, last-ditch line of defense -- if you're going to use one, make it a good one, one that the authorities can neither guess nor brute-force.
Nightcrawler
4096R/BBF7433B 2012-09-22 Nightcrawler <Nightcrawler@SR>
PGP Key: http://dkn255hz262ypmii.onion/index.php?topic=174.msg633090#msg633090
PGP Key Fingerprint = D870 C6AC CC6E 46B0 E0C7 3955 B8F1 D88E BBF7 433B
Security is a bit like religion... some things have to be taken on faith.
Where security differs from religion is that security is NOT retroactive.
Unlike Christianity, where you can come to Jesus, be 'saved' and have all
your sins washed away, with security you can adopt Tails or PGP, and be
secure from that point forward, but rest assured that your previous sins
(security failings) WILL come back to haunt you and bite you in the ass.
The original DPR is the poster child for that, right now.
